Organizations are increasingly seeking faster threat detection, stronger investigations and coordinated incident response, according to a new global study by Kaspersky’s Internal Research Center.
As the threat landscape evolves and IT environments become more distributed, companies are rethinking how they protect their infrastructure. Endpoint protection remains essential, but organizations are increasingly connecting security capabilities to improve visibility and coordinate their response to threats. These are among the findings of a new global study by Kaspersky’s Internal Research Center, based on responses from almost 2,000 IT and cybersecurity decision-makers across Europe, Russia, Asia-Pacific, the Middle East, Turkey and Africa and Latin America.
Endpoint protection remains essential — but no longer stands alone
Endpoint security remains a core component of corporate cyber protection, with Endpoint Detection and Response (EDR) solutions deployed by 78% of large organizations. Yet businesses are increasingly combining endpoint security with other technologies to strengthen detection, investigation and response.
The most widely reported combination of security solutions, used by 50% of companies, includes EDR, Next-Generation Firewall (NGFW) and Incident Response (IR). It reflects a layered security approach that extends protection from endpoints to the network perimeter and supports incident containment and remediation.
A further 25% of organizations report using Security Information and Event Management (SIEM), Extended Detection and Response (XDR) and Threat Intelligence (TI) together, bringing security data, cross-environment detection and actionable threat insights into a clearer picture of emerging risks and potential attacks.
Tool consolidation and automation shape the next phase
As security stacks expand, managing disconnected tools is becoming a challenge. More than a quarter of companies (26%) cite the need to consolidate multiple security tools on a single platform as a key reason for considering a vendor change in the coming years. The priority is not simply to reduce the number of products, but to connect security operations, simplify management and enable more automation and coordinated responses.
The survey results reflect this shift: XDR and SIEM are already used by more than 60% of large enterprises, making them among the most widely adopted security technologies after EDR. XDR adoption is expected to increase by a further eight percentage points over the next year, from 63% to 71%, reinforcing the trend toward unified threat detection, investigation and response.
As organizations consolidate their security operations, demand for complementary technologies is also expected to grow. Threat Intelligence and Network Detection and Response (NDR) adoption are projected to increase by eight percentage points each, while DDoS protection are set to grow by 10 points. These capabilities extend platform visibility, enrich detection with threat context and strengthen protection across network and operational environments.
Together, these trends point to a move toward integrated security ecosystems in which centralized platforms correlate data from multiple sources and specialized solutions provide deeper protection, enabling more efficient and coordinated security operations.
"The research clearly demonstrates that organizations are increasingly moving toward integrated security ecosystems, which reflects a recognition that traditional, siloed approaches are no longer sufficient in today’s complex threat landscape. By unifying and automating their security tools, companies significantly enhance visibility, reduce response times and improve coordination. This evolution is vital for establishing robust protection and maintaining a proactive stance against sophisticated cyber threats in an environment where immediate action is essential," comments Ilya Markelov, Head of Unified Platform Product Line at Kaspersky.
To help companies build an integrated security approach, Kaspersky recommends that organizations do the following:
· Consolidate security monitoring and response with an integrated platform. Solutions such as Kaspersky Next XDR Expert aggregate and correlate security data from multiple sources, leveraging AI to improve threat detection and enable faster, automated incident response.
· Enhance security operations with centralized analytics. Organizations operating a security operations center can use Kaspersky SIEM to centralize security event management, correlate events and turn large volumes of telemetry into actionable insights.
· Enrich platform capabilities with dedicated security technologies such as Kaspersky Threat Intelligence. It gives security teams timely, actionable insights into threat actors, their tactics, techniques and procedures (TTPs), and indicators of compromise (IoCs), helping them assess risks more accurately and make faster, better-informed response decisions.
· Strengthen protection across cloud-native and virtualized environments. For example, Kaspersky Cloud Workload Security offers comprehensive protection for hybrid cloud and DevOps infrastructures. Flexible licensing and ease of integration into any existing IT landscape make it an ideal fit for companies with diverse and complex environments.
· Extend detection and response capabilities with managed security services. Organizations seeking to augment their in-house security operations can use Kaspersky Managed Detection and Response to benefit from expert-led threat monitoring, investigation and response. This helps improve the detection of sophisticated threats and reduces the burden on internal security teams
Organizations can also learn more about changes in cybersecurity strategies with Kaspersky’s interactive IT Security Calculator or identify security gaps with the questionnaire-based Cyber Risk Heatmap evaluation.
